Is there a command line two-factor authentication verification code generator?

Question

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup is described here: http://www.mnxsolutions.com/security/two-factor-ssh-with-google-authenticator.html

I would like a way to get the verification code using just my laptop and not from my iphone. There must be a way to seed a command line app that generates these verification codes and gives you the code for the current 30-second window.

Is there a program that can do this?

Solution 1

Yes, oathtool can do this. You'll need to seed it with the shared secret from your server.

You can install it from the oath-toolkit package.

Example usage to generate same code as google authenticator and authy:

oathtool -b --totp 'N3V3R G0nn4 G1v3 Y0u Up'

Solution 2

There is also a go implementation on github at https://github.com/pcarrier/gauth

This one uses a config file ~/.config/gauth.csv to store the tokens in a the following format

[email protected]: abcd efg hijk lmno
aws-account: mygauthtoken

And the output is rather friendly too:

$ gauth
           prev   curr   next
AWS        315306 135387 483601
Airbnb     563728 339206 904549
Google     453564 477615 356846
Github     911264 548790 784099
[=======                      ]

Solution 3

There's many 3rd party Authenticator implementations. Check out the list on the wikipedia page. For instance, you may be able to use onetimepass (which is written in Python) for command line usage.

Solution 4

As far as I'm aware Google only releases the Authenticator application for phones (iOS, Android).
(This poses a problem for paranoid folks like me, who don't really trust Google's history of discontinuing services with little notice, and would prefer a token generator we can see inside of.)

You could consider other alternatives, like a one-time password pad system.

---

Honestly, getting the verification code from your laptop kind of defeats the two-factor authentication aspect (anyone who captures the laptop now has the code generator - that's part of what Authenticator is supposed to protect against).

Solution 5

You could try http://soundly.me/oathplus

This is a tool I developed on top of the venerable oathtool, that lets you read QR codes, and stash OTP account info for later use. You can think of it as Google Authenticator for the command-line, since it can download and read QR codes, and consume otpauth:// URIs. (OSX only atm.)

View more solutions

Comments

[voretaq7]

Is this compatible with the Google Authenticator PAM module? It seems like a different (though functionally equivalent) beast...

[EEAA]

Yep - with the --totp flag, it implements the same standards-compliant TOTP alg that Google Authenticator does.

[Zouppen]

It's oathtool. In many cases you need both --totp and -b flag (base32 decoding)

[JDS]

FWIW, I wrote a shell wrapper for oathtool that is functionally equivalent to Authy on the CLI: github.com/poolpog/bash-otp

[Tino]

FWIW: I wrote a C-wrapper which uses libpam-google-authenticator to verify tokens. See github.com/hilbix/google-auth - in the README there is function checktotp shown. Just remove the | fgrep -qx "$1"; to see the tokens.

[Jerry]

I agree with the sentiment that a separate device is fundamentally necessary for 2FA. However, could that secondary device be a remote server?

[cjs]

Storing your TOTP secret on your laptop instead of your phone is still much, much better than no TOTP at all if you don't store your password on your laptop (e.g., in your browser's password agent). MITM attackers (such as key loggers) do not have access to the TOTP secret, just the time-based code, and so capture auth info good only for a minute or two. A stolen laptop has the TOTP secret, but not the password. (You'll need to use a weaker password to make it memorable, but that's ok with TOTP.) Making attackers both sniff the password and steal the secret complicates their task.

[cjs]

One more note: TOTP as practised is technically not two-factor auth in the strictest sense, because both the password and the TOTP secret are "something you know." Either can be copied without the owner's knowledge of the loss of secrecy.

[gadelat]

No longer maintained and cannot be launched on recent OSX versions

[Ralph Bolton]

Just to add, if you need the Centos RPM, it's oathtool